GPG – Fixing ‘No Public Key’ Errors When Adding Passwords to ‘pass’ Password Manager

You can do this if you are running gpg-agent (and your passphrase is loaded), by looping through the files in your password store and writing them to a separate file.

You do have to strip the leading directories from the path ($PASSWORD_STORE_DIR) and the .gpg extension from each of the files in the subdirectories, but otherwise it is straightforward enough:

#!/usr/bin/env bash
# export passwords to external file

shopt -s nullglob globstar
prefix=${PASSWORD_STORE_DIR:-$HOME/.password-store}

for file in "$prefix"/**/*.gpg; do                           
    file="${file/$prefix//}"
    printf "%s\n" "Name: ${file%.*}" >> exported_passes
    pass "${file%.*}" >> exported_passes
    printf "\n\n" >> exported_passes
done

The pass password manager requires a public key for encrypting its files (where the managed passwords are stored) - and it requires a private key to decrypt its files.

It isn't possible to configure pass to use gpg's 'pure' symmetric file encryption (cf. the -c or --symmetric GPG options).

This is due to the design of pass - using GPG's public key cryptography for file encryption/decryption allows for flexibility, e.g. for configuring multiple keys - say - such that a group of users has access to the managed passwords.

Also note that GPG uses a hybrid scheme when encrypting a file for one or many recipients (i.e. using one or many public keys): it randomly generates a session key for the symmetric encryption of the file and then just uses the public key/keys to encrypt the session key.